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Ab s t rac 1 t 

r his paper describes an experimental version 
ot an expert system flight status monitor being 
develooeu at the Dryden Flight Research Facility 
of th° NASA Ames Research Center. This experimen- 
tal expert systen flight status monitor (EESFSM) 
is supoorted by a specialized knowledge acquisi- 
tion tool that provides the user witn a powerful 
and easy-to use documentation a^d rule construc- 
tion tool. The EFSFSM is designed to be a testbed 
for concepts n rules, inference mechanisms, and 
knowledge structures to be used in a real-time 
expert systen flight status monitor that will 
monitor the health and status of the flight 
control systen of state-of-the-art, h-gh- 
perf rmnance , research aircraft. 

Nomenclature 

AF T I advanced fighter technology integration 

ASF' 1 aircraft sensor and failure management 

CRT cathode ray tube 

DFCS digital ''light control system 

-ESFSM experimental pxpert system flight 

status monitor 

HiMAT highly maneuverable aircraft technology 

KAT knowledge acquisition tool 

RTESFSM real-time expert system flight status 

monitor 

Introduction 

An expert systen capable of monitoring the 
healtn and status of flight-crucial control 
systems on high-performance research aircraft 
is being developed at the Dryden Flight Research 

Facility of thp NASA Anes Research Center.^ The 
goal of thp project is to produce an expert sys- 
tem that will be used in an on-line, real-time 
application. This application system (Fig. 1) 
will accept telemetry downlink data from the 
aircraft and apply various inference mechanisms 
to deduce conditions of concern or alarm. The 
application system will interface with both a 
'light systems engineer on the ground and a 
research test pilot in the vehicle. 

This expert system flight status monitor 
will process the large amounts of health and 
status data typical of current digital flight 
control systems. A flight control system 
typical of state-of-the-art digital flight 
control systems was chosen for analysis and 

‘Aerospace engineer. Member AIAA. 

“Aerospace engineer. 


study (F’g. 2), this choice was based on 
experience with a variety of aircraft. This 
system has 66 failure and 30 status indicator 
bits sampled at AO Hz. The amount of data 
available from such a system can be at or beyond 
the data processing ability of a human. The goal 
of the expert system flight status monitor is to 
interp'et these data into information of immediate 
concern to the flight systems engineer or research 
test pilot. 

The planned development of this expert systen 
flight status monitor consists of several phases 
(Fig. 3). The 'irst phase is the development of 
an off-line experimental demonstration system 
with a knowledge uase characterizing a repre- 
sentative aircraft system, this first phase also 
includes the development of a knowledge aquisi- 
tion tool (KAT) to aid in the development of the 
knowledge base. During the second phase of the 
program a real-time version of the expert system 
flight status monitor will be interfaced to a 
real-time piloted, f 1 1 ght-hardwarr -l n-the-1 ood 
simulation for verification and validation of an 
ai rcraf t-speci l knowledge b=>se and the inference 
necnamsms. T third phase of the program will 
be a control room application that will utilize 
the verified and validated application system as 
an on-line monitor to provide assistance to a 
flight system engineer during flight research 
missions. The final phase of development will 
include an additional interface with the research 
test pilot using telemetry uplink and downlink. 

This paper describes the experimental expert 
system flight status monitor (EESFSM) demonstra- 
tion system and KAT that were developed using 
Common LISP on a multiuser VAX 11/750. The EESFSM 
includes several different knowledge representa- 
tions and inference mechanisms in fact, it can 
be represented as a collection of several expert 
systems. The EESFSM also simulates the proposed 
structure of the real-time expert systen flight 
status monitor (RTESFSM) application systen with 
task partitioning into emulations of foreground 
and background tasks. The expert system is sup- 
ported by a specialized KAT that allows the user 
to collect and properly format information for 
the expert system flight status monitor. 

^c^g_rou_n_d 

The increasing complexity of modern high- 
performance aircraft systems requires innovative 
techniques that allow the flight test community 
to safely and effectively test these systems prior 
to their generalized use. These complex systems, 
often crucial to flight safety, require teans of 
engineers in a ground control station for analysis 
and monitoring. These systems are diverse, with 
applications ranging from new and unusual air- 
craft, such as the X - 29 forward-swept wing (FSW), 
through advanced avionics and flight control 
systems, as on the advanced fighter technology 
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integration (AFTI) F - 1 6 , or advanced wing design 
and control , as on the AFTI/F-111 or F-8 oblique 
wing. The current techniques available to engi- 
neers involved in flight testing include moni- 
toring analog parameters on strip charts and 
CRTs and monitoring discrete information, such 
as system status and failure identification, on 
CRT displays or light boards. The engineers 
involved in flight testing are required to have 
a thorough knowledge of the system they are moni- 
toring and to be able to identify critical events 
as they occur. In the brief time available during 
critical flight test events (which are often high- 
stress situations), it is difficult for any indi- 
vidual or group of individuals to always correctly 
identify and rectify, if necessary, the problems 
that often occur on new, advanced systems. 

A major concern in advanced high-performance 
aircraft is the digital flight control system 
(DFCS). These advanced aircraft are often sub- 
stantially unstable and require augmentation 
from a full-time, ful 1 -authority DFCS. Because 
these DFCSs are essential, the monitoring of the 
flight control system becomes critical. Problems 
occurring in the flignt control system can cause 
an aircraft to be lost or a flight to be aborted 
or canceled, or they can force modification of 
the flight testing. Fast and informative displays 
relating the status and health of the flight con- 
trol system can save a flight, a mission, or the 
aircraft itself. Current flight test monitoring 
technology involves discrete data transmitted from 
the aircraft and displayed on CRTs or light panels 
with little, if any, interpretation. 

Figure 4 illustrates the levels of flight 
monitoring automation involved in evaluating 
and correcting the status and health of DFCSs. 

Level 1 represents early systems monitoring with 
primitive capabilities involving immense light 
panels that display the discrete information with 
no interpretation or evaluation, as on the early 
highly maneuverable aircraft technology (HiMAT) 
program. On the HiMAT flights the systems engi- 
neer was required to monitor over 100 lights, 
determine the status and health of the flight 
control system, and recommend the appropriate 
action to correct problems. 

The current level of flight monitoring is 
level 2, in which some logical operations are per- 
formed on the discrete information downlinked from 
the aircraft. However, although some interpreta- 
tion is available, the systems engineer is still 
required to determine the DFCS status and health 
from multiple discretes displayed on a CRT. Both 
the AFTI/F-16 and X-29 FSW aircraft, with their 
complex DFCSs, are currently at this level of 
automation In systems monitoring, the systems 
engineer still must assemble all the information 
and determine the status or health of the DFCS. 

Level 3 automation requires a system that 
Interprets the data and provides this informa- 
tion automatically to the systems engineer. 

Further enhancements to such a system would 
permit the monitoring system to automatically 
recommend corrective action, and relate the ra- 
tionale behind those recommendations, at level 4. 
Level 5, represents a system that evaluates the 
health and status of the DFCS and automatically 


reconfigures the control system to accommodate 
this evaluation. The body of this paper discusses 
an EESFSM that supports the design of a system at 
level 3 and is capable of developing into level 4. 
An expert system flight status monitor is being 
developed that will inform the systems engineers 
of a flight control system problem and determine 
the cause of the problem. This expert system 
will recommend corrective action and delineate 
the appropriate procedures for normal and emer- 
gency operation. 

An expert system capable of intelligently 
monitoring the flight systems of highly complex 
aircraft has application beyond flight research. 

In the emerging generation of complex, digital, 
systems-dn ven aircraft, it is difficult for a 
flight systems expert, a research test pilot, 
and the rest of a flight research support team 
to understand and interpret system malfunctions, 
however, it may be impossible for an operational 
pilot to effectively cope with flight system prob- 
lems. This consideration has led to the concent 
of extending the expert system flight status moni- 
tor to an onboard system that could be developed 
during aircraft design, validated during flight 
test, and applied to production aircraft. 

Description of F light Contr o l System 

Figure 2 shows a three-channel representa- 
tion of the class of flight control systems that 
can be accommodated by the expert system flight 
status monitor. This representat've control sys- 
tem has many of the characteristics assumed in 
the development of the EESFSM and KAT. The pre- 
liminary knowledge base being developed is based 
upon this representative flight control system. 

To insure that the expert system flight status 
monitor and knowledge acquisition program are 
broadly applicable generic tools, these programs 
will be applied to the flight control systems of 
at least two high-performance aircraft. 

The representative flight control system 
shown in Fig. 2 is a triplex configuration with 
both input and output voting. This flight con- 
trol system also contains a triplex independent 
backup system that is dissimilar to the primary 
system. Each digital channel can independently 
switch between the primary and backup systems. 

The primary digital control system is a multimode 
system that can be configured to accommodate dif- 
ferent phases of flight or to tolerate a limited 
number of input sensor failures. 

Each channel of the representative flight 
control system has its own suite of sensors 
and signal conditioning hardware. The sensor 
outputs within a channel may be used in the 
primary digital control system, the backup con- 
trol system, or both. Each channel receives 
sensor inputs and transmits the data to the 
other channels through a serial link. The 
average redundancy of the input sensors is 
three. Both the backup mode and the digital 
computers have independent dc power supplies, 
but the ac power (used by various sensors) is 
derived from the analog backup dc power. The 
DFCS votes on the control output to the actu- 
ators using a bit-by-bit comparison. Each 
channel drives an electromechanical servo valve 



on self-voting actuators. The actuators deter- 
mine the status of the dual hydraulic system and 
select the appropriate hydraulics. The flight 
control system monitors both the actuators and 
the hydraulic system to determine their viabil- 
ity. The coil currents on the actuator electro- 
hydraulic valves are monitored as are the hydrau- 
lic pressure descretes. 

Ov e_r vi_e_w_ of_ Expert System 
FI i gh t Stat us Mo nitor 

The FESFSM demonstration system is an exper- 
imental program to aid in the exploration of con- 
cepts in rules, inference mechanisms, and knowl- 
edge structures that will be used in the RTESFSM 
application system. The EESFSM system wi 11 be 
used not only as a means of testing and verifying 
the knowledge base but also as a postflight analy- 
sis tool. Figure 5 shows the three sources from 
which the EESFSM can accept data flight data 
files, simulation data files, or downlink indi- 
cator bits set by the user through a terminal. 

The expert system accepts input data one frame 
at a time and processes the data from each frame 
using inference mechanisms similar to those that 
will be used in the real-time system. 

Operational _Mo_d_e s 

The EESFSM has two basic modes of operation — 
step and automatic-until-error. In the step mode, 
one frame of data is input and processed, afte r 
each frame is processed, the user has the option 
of changing modes, examining data buffers or 
deduced-fact repositories, or altering any of the 
options available. In the automatic-until-error 
mode, the EESFSM reads and processes frames until 
an error is detected, when an error is detected, 
the EESFSM reverts to the step mode. The user may 
select the types of errors that will cause a halt 
in processing and reversion to the step mode. 

After processing each frame of data, the EESFSM 
splays cautions and warnings deduced from the 
k owledge base and input data. This information 
(along with results from the application of the 
system operability rules) represents the sort of 
information that would be displayed to the systems 
engineer by the RTESFSM. 

The automatic-until-error mode was mechanized 
to allow the user to process flight data without 
being required to step through frames of data. 

By allowing the user the option of specifying a 
range of errors that, if detected, cause the 
program to wait for user interaction, long un- 
eventful flight tapes can be quickly processed 
and searched for errors. The options available 
to the user range from stopping if any failure 
indicator is on to the use of any rule conse- 
quent as the stopping criterion. 

One of the options available to the user of 
the EESFSM is data recording. This capability 
allows the user to create a simulation aata file. 
When the data recording option is selected, each 
frame of data that ’S input to the EESFSM is 
recorded on a simulation data file. These frames 
of data can be user input, frames read from the 
flight data file, or frames read from a simulation 
file. Thus, now simulation files can be created 


by mixing data from several sources to create data 
files for testing or demonstration purposes. 

Inference Mechanisms 

The EESFSM monitor consists of several 
separate expert systems, each with its own 
infe r ence mechanism. The internal structure of 
the EESFSM is shown in Fig. 6. These infererce 
mechanisms are predominately forward-chaining, 
data-driven processes. The aircraft sensor and 
failure management (ASFM) expert system uses a 
forward-chaining mechanism to model the aircraft 
failure management system and deduces cond’tions 
of concern or danger based on the failure indica- 
tor information. A metamomtor expert system 
deduces situations of concern based on knowledge 
of deductions from the ASFM expert system and 
the aircraft failure management system. The 
situations of concern deduced by the metamomtor 
are analyzed by a fault isolation expert system 
that deduces probable causes of conflicts, recom- 
mends corrective actions, and issues warnings. 
These expert systems provide detailed system sta- 
tus information and perform a function comparable 
to that of a flight systems expert. 

The system operability expert system uses 
knowledge of the system effectiveness and the 
detailed system status information to provide 
a high-level assessment of the the ability of 
the flight control system to control the air- 
craft, complete a specific mission, or func- 
tion in a given mode. This assessment is 
performed by a backward-chaining mechanism 
using hypotheses in an order established by 
the user. The order of the hypotheses is 
important because it provides a means for 
the expert system to determine priorities, 
the system uses this knowledge of priorities 
to determine the highest level at which the 
system is operable and provides this informa- 
tion to the user. The system operability 
rules are also used to establish the worst 
consequences of any additional failure. This 
analysis (called next worst failure analysis) is 
possible because of the ordering of hypotheses. 

The EESFSM also includes a procedural aiding 
expert system that provides normal and emergency 
procedures information to the user. The user 
interface in the EESFSM provides system status 
information, explanations, and rule maintenance. 

Explanation Fac il ities 

When the EESFSM pauses between frames in the 
step mode, the user can ascertain which indicators 
are on, which rules have been used, and which 
facts have been deduced. For any deduction, the 
user can request an explanation of how that deduc- 
tion was reached, the EESFSM will use the deduc- 
tion repositories, input data, and knowledge base 
to reconstruct its reasons for asserting any 
deduction. 

When defining the knowledge base, the user may 
also force automatic explanation for conclusions 
that either indicate emergency conditions or 
invoke special procedures. This is accomplished 
by establishing an automatic explanation level 



when the user orders the consequents of the system 
operability rules. 

Expert System Ru les 

The rules within jn expert system describe 
the knowledge one wi'hes to define about a process 
or object. The rules used in the EESFSM serve to 
characterize the Tight control system of a redun- 
dant digital-fly-by-wire vehicle. This charac- 
terization includes a definition of the flight 
control system health and status information, a 
definition of redundant system elements, a model 
of the vehicle's failure management system, and a 
definition of emergency procedures associated with 
flight control system failures. Each rule may be 
thought of as a simple fact or procedure. Thus, 
using a traditional if-then representation, the 
following might be relevant rules 

.f the pitch rate gyros have failed, 

hen the longitudinal rate-damping mode 
has failed. 

If the orimary flight control system has 
failed and the backup flight control 
system has failed, 

then the procedure is ejection. 


The value of these if-then production rules is 
that the system can be defined using small 
"crunks" of information without having to link 
these chunks together into a well-defined total 
system description. The total system is defined 
only by the collection of the individual rules 
into a knowledge base. These facts are actually 
linked by the inference mechanism, which tests 
whether the condition or state represented by the 
antecedents of a rule accurately describe the 
current system state before applying a rule. Only 
those rules applicable to the current system state 
are used at any one time. As the ruTes are used, 
the inference mechanism adds the consequents of 
the rule to the system status description. Thus, 
in using production rules in this forward-chaining 
process, the inference mechanism starts from a few 
system facts and reaches whatever conclusions are 
defined in the individual rules. As long as one 
rule has been used in a pass through the knowledge 
base, the inference mechanism must continue trying 
rules on each successive pass. The inference 
mechanism stops processing rules only when the 
last pass proceeds with no rules being applied. 

The EESFSM uses several different representa- 
tions of rules (Fig. 6). Some of these repre- 
sentations are in the form of traditional if-then 
production rules. However, many of the rules are 
defined in unusual formats to facilitate defini- 
tion of the knowledge base and to increase execu- 
tion speed of the inference mechanisms. 

The basic rule representations were estab- 
lished to eliminate, wherever possible, the 
traditional if-then production rules. This 
was motivated by the relationship between the 
execution time of production rules and the number 
of rules applied. While not an exact formulation, 
this relationship has exponential characteristics, 


that is, as thr numbpr of rulps applied increases, 
the time required to apply them increases exponen- 
tially. The partial elimination of production 
rules has been accomplished by recognizing that 
the total system knowledge base could be parti- 
tioned into multiple knowledge oases that could 
be processed sequentially. Some of these subpar- 
titions of the total system knowledge base re- 
quired the use of production rules, however, it 
was recognized that in several of these subpar- 
titions the power and computational expense of 
production rules were inappropriate. The subpar- 
titiomng of the total system knowledge base is 
described in detail in the following paragraphs. 

The total system knowledge base used with the 
EESFSM is actually composed of several knowledge 
bases, each of which may be considered as a 
separate knowledge base supporting the collection 
of limited-domain expert systems that constitute 
the EESFSM. Each of these knowledge bases is 
distinct, although the rules in these knowledge 
bases are often applied to common repositories of 
system status information. 

The indicator rules are simply lists of names 
used to identify bits or words in the flight 
system time-history input to the expert system 
flight status monitor. Three distinct types of 
indicators are used failure indicators, status 
indicators, and cross-channel assessment indica- 
tors. The names of these indicators are used when 
the data structures of the input frames are 
defined and in the inference mechanism of the 
expert system. Within the inference mechanism of 
the EESFSM, when a bit or word corresponding to 
the user-defined location of an indicator is set 
(such as on or true), the inference mechanism adds 
a fact, which identifies a specific indicator as 
being on, to the main system status repository. 

Multiple-element indicator rules are lists of 
indicators that are similar in function. The pri- 
mary purpose of these rules is to easily accom- 
modate redundant elements. When these rules are 
applied, a fact that identifies the number of 
failures of the type defined by the multiple- 
element indicator rule is added to the main system 
status repository. Two types of multiple-element 
indicator rules are used intrachannel and 
interchannel multiple-element sensor rules. The 
intrachannel rule is used to identify failures of 
redundant elements within a single channel of the 
flight control system, the interchannel rule is 
used to identify failures in redundant elements 
within the flight control system as a whole. 

Traditional if-then production rules are 
used to model the vehicle's failure management 
system. These rules can also be used to model 
the interconnections and dependencies within 
the flight system. Two types of these rules 
are used within the expert system flight status 
monitor intrachannel and interchannel system 
rules. These rules use the facts derived from 
the indicator and multiple-element indicator 
rules to deduce information about the vehicle’s 
flight system state. This information is used 
to detect flight system failures that might not 
be included in the vehicle's failure management 
system or to identify failures within the fail- 



‘.lire management system itself. With the cap- 
ability of entering and accomodating rules that 
can detect flight system failures not included 
in the vehicle's failure management system, the 
EESFSM provides a mechanism for correcting design 
deficiencies that could be too costly to correct 
by modifying the vehicle. Flight system rules can 
also be used to generate messages identifying con- 
ditions of interest or concern. 

Conflict detection rules identify failures or 
discrepancies in the vehicle's failure management 
system. These rules compare the system health and 
status indicators provided by tne vehicle failure 
management system with facts deduced by applying 
the system rules. The intrachannel conflict rules 
are used to identify conflicts within a channel 
and consist of pairs of indicator-like names, the 
interchannel conflict rules are simply indicator- 
like names that are compared across channels. 

Each conflict rule nas an associated definition of 
seventy that is used to determine the appropriate 
actions to be taken if a given conflict is 
detected. 

Conflict resolution rules are useo for fault 
isolation or procedure initiation whpn conflict- 
ing information is detected by tne conflict rules 
These rules can be used to detect specific fail- 
ures within the vehicle's failure management 
system or within the onboard failure detection 
system. The entire system status information 
repository is available to these rules. Addition- 
ally, these rules may initiate queries to the uspt 
for information about the vehicle system. These 
rules can add facts to the system information 
repository or initiate procedures that may serve 
to isolate faults. 

Procedural rules are have the primary purpose 
of mechanizing the emergency procedures associated 
with failures in the flight system. However, pro- 
cedural rules may be used to define any procedure 
that might be needed. Procedural rules also con- 
tain information associated with each antecedent 
clause that identifies where a specific fact 
should be sought (in the system status informa- 
tion repository or from the user). 

System operability rules are used to provide 
high-level information on the health and status 
of the vehicle flight system in general, but 
they also provide information on the particular 
control system mode being used. These rules are 
meant to provide the user with only the most 
general information (such as, "the flight sys- 
tem is operational" or "the longitudinal rate 
damping mode is not operational"). These rules 
are structured as traditional if-then production 
rules. Their consequents are used to establish a 
hierarchical set of hypotheses for the backward- 
chaining inference engine. 

Knowledge Acquisition Jj?_ol_ 

The knowledge acquisition tool (KAT) used 
with the EESFSM and designed to support all 
phases of the expert system flight status mon- 
itor project provides a user-friendly interface 


to the knowledge base. This program has facili- 
ties for entering all types of rules used within 
the EESFSM. In addition to supporting the expert 
system, the KrtT is a powerful tool for developing 
documentation on the flight control system of an 
aircraft. The knowledge base developed using the 
KAT can also lead to an understanding of a flight 
control system that augments more traditional 
approaches to flight system documentation. 

The power of a knowledge acquisition pro- 
gram such as the KAT, which is tailored to 
a specific application, is that the program 
can aid the user in the defin'tion of the 
knowledge base by generating prompts and 
explanations that are more appropriate for 
a domain expert than for a computer scientist 
or knowledge engineer. The KAT is designed 
to be used by flight systems engineers. 

This knowledge acquisition program was deve- 
loped after a brief but painful experience with 
defining the knowledge base directly. Sone of 
the problems encountered before the development 
of the knowledge acquisition program could have 
been alleviated had a general -puroose knowledge 
engineering program been used, however, many of 
these difficulties are endemic to knowledge 
engineering in general . 

The main problem addressed by thp KAT is 
application-unique and specialized knowledge 
(rule) representations. Ry building a KAT speci- 
fically for flight system applications, the rules 
described in the preceding section (Expert System 
Rules) could be accommodated. This allowed the 
expert system designers the freedom to apply their 
insights into and knowledge of flight systems to 
build an efficient and generic set of inference 
mechanisms. The designers used the KAT to tailor 
the exoert system to the application rather than 
attempting to tailor the application to the KAT. 

Another problem addressed by the KAT is that 
of consistency in the clauses of rules. Any dif- 
ferences in clauses intended to be the same can 
cause additional rules to be used or can cause 
rules not to be used as anticipated. On the sur- 
face this seems a trivial problem, but when one 
considers a knowledge base of several hundred 
rules, the problem of clause consistency can 
become a time consuming and tedious exercise. 

The KAT developed to support the EESFSM provides 
features that minimize, if not eliminate, the 
problem of clause consistency. 

Summa ry 

This paper describes an experimental version 
of an expert system flight status monitor being 
developed at the Dryden Flight Research Facility 
of the NASA Ames Research Centpr. This experimen- 
tal expert system flight status monitor (EESFSM) 
is being developed as a testbed for concepts in 
rules, inference mechanisms, and knowledge struc- 
tures to be used in a real-time expert system 
that will monitor the health and status of the 
flight control systems of state-of-the-art, high- 
performance, research aircraft. 
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The EESFSM is supported by a knowledge 
acquisition tool (KAT) that provides a user- 
friendly interface to the knowledge base. This 
proqram has facilities for entering all types of 
rules used witmn the EESFSM. In addition to sup- 
porting the expert system, the KAT is a powerful 
tool for developing documentation on the flight 
control system of an aircraft. 7 he knov/ledge base 
developed usi'g the KAT can also lead to insights 
and promote an understanding ot the flight control 
system that augments more traditional approaches 


to flight system documentation. Thr expert systen 
flight status monitor and KAT are designed to be 
generic, capable of accommodating a broad (lass of 
flight control systems. 
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Fig. 3 Development process for expert system flight status monitor. 
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? 

PRIMARY YAH RATE CYRO C FAR-BIT 

NIL 

to 

lateral ACCELEROHETER-A-FAIL-BIT 

Nil 

It 

LATERAL -ACCELEROflCTER-B-f AIL BIT 

NIL 

12 

LATERAL -ACCELER3HE TER c-p ail-bit 

NIL 

13 

LONCITUDINAL-ACCEIEROMETER A-FAiL-BIT 

NIL 

14 

LONCITUDINAL-ACCELEROMETER B FAIL-BIT 

NIL 

15 LONCITvDIMAl-ACCEl'RWETER C FAIL BIT 

okhands 

? ACt DitplM nut indicators 

NIL 

DISPLAY Display status indicator’s f row specified number 

DONE Process data 

I0CCLE CManje stitf« of specified indicators 

INITIALIZE Peset indicators to Off 
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